From d27bcb1a5908a0ae81823cd7c7e101fd89ebb556 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 7 Jul 2026 16:40:12 +0200 Subject: [PATCH] Mark RAIL-HO-WP-0005-T06 done after SMTP delivery verified IONOS mail via OpenBao/ESO and smtp.ionos.de STARTTLS confirmed with operator test email and forgot-password delivery. --- ...HO-WP-0005-forgejo-production-migration.md | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md b/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md index 7d6cfad..4875025 100644 --- a/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md +++ b/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md @@ -8,7 +8,7 @@ status: active owner: railiance topic_slug: railiance created: "2026-05-03" -updated: "2026-07-07" +updated: "2026-07-08" state_hub_workstream_id: "84e17675-0d15-4268-a8bd-540124d37018" --- @@ -62,8 +62,8 @@ change is made there. `the-custodian/docs/forgejo-production-decisions.md`. 2. ~~Mail delivery path~~ **DECIDED 2026-07-07:** IONOS SMTP for `@coulomb.social` mailboxes (operator-provisioned domain/subdomains). Sender mailbox TBD - (`forgejo@coulomb.social` recommended); SPF/DKIM via IONOS zone. T06 still - requires password-reset test after creds are deployed. + (`forgejo@coulomb.social`); SPF/DKIM via IONOS zone. T06 SMTP delivery + verified 2026-07-08. 3. Package registry scope: container images only at first, or also generic, npm, PyPI, Go, Maven, and Helm packages. 4. ~~Actions runner model~~ **DECIDED 2026-07-03:** in-cluster long-lived runner @@ -113,7 +113,7 @@ acceptance criteria below are tracked across T05, T07, T08, and T10 instead. Still to prove before T11: -- SMTP/password reset end-to-end (T06). +- ~~SMTP/password reset end-to-end (T06).~~ **done** (2026-07-08). - Backup and restore in isolated namespace (T09) — **drill passed 2026-07-04**; scheduled automation pending. - Issues/releases/wiki/LFS per inventory classification (T10 matrix). @@ -184,7 +184,7 @@ Decide the production choices listed in "Key Decisions to Confirm". **Partial (2026-07-07):** hostname, exposure, deployment pattern, live deploy, in-cluster runner model (`ADR-004`), and **SMTP provider (IONOS)** decided. Cutover mode **leaning** staged per-repo (glas-harness pilot). Remaining -operator decisions: sender mailbox name + T06 test, package scope beyond OCI, +operator decisions: package scope beyond OCI, backup target, final cutover confirmation. See `the-custodian/docs/forgejo-production-decisions.md`. @@ -275,7 +275,7 @@ Minimum scope: ingress + TLS, SSH NodePort `30022`, Actions enabled, `coulomb` org, `railiance01-build-01` runner (ADR-004). Git push/pull via HTTPS and `forgejo-remote` SSH proven. Remaining: SOPS hardening for all secrets, -SMTP (T06), operator user accounts beyond `forgejo_admin`. +operator user accounts beyond `forgejo_admin`. **Done when:** Forgejo runs on railiance01 against production platform services and can serve login, git clone/push, package registry, and admin @@ -287,9 +287,9 @@ operations. ```task id: RAIL-HO-WP-0005-T06 -status: todo +status: done priority: high -needs_human: true +needs_human: false state_hub_task_id: "417faa4d-eab8-4247-9485-4f80e5d5b7ff" ``` @@ -299,13 +299,18 @@ Configure and test mail delivery for account recovery. See `the-custodian/docs/forgejo-production-decisions.md` and `railiance-apps/docs/forgejo-on-railiance01.md` (SMTP section). +**Verified (2026-07-08):** OpenBao path `platform/workloads/forgejo/forgejo-mailer` +(field `PASSWD`) → ESO → Helm `GITEA__mailer__PASSWD`. Mailer uses +`smtp.ionos.de:587` with `PROTOCOL=smtp+starttls` (EU relay; `.com` auth fails). +Operator test email and forgot-password flow delivered to `bernd.worsch@gmail.com`. + Minimum scope: -- SMTP credentials stored through the approved secret path (`forgejo-secrets.sops.yaml`). +- SMTP credentials stored through the approved secret path (OpenBao + ESO). - Sender address and domain alignment documented. - Password reset email works for a controlled non-admin account. - Account recovery runbook covers lost password, lost MFA, disabled account, - and emergency admin access. + and emergency admin access (emergency path: `forgejo admin user change-password`). - Mail failure is observable through logs or a health check. **Done when:** a user can complete password recovery without operator database @@ -564,8 +569,8 @@ T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots) **Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3 `state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill -**passed** but scheduled backups + backup target still open. T02/T06 SMTP and -backup-target decisions remain operator-gated. T11 partial: `state-hub` primary +**passed** but scheduled backups + backup target still open. T02 backup-target +and package-scope decisions remain operator-gated. T11 partial: `state-hub` primary on railiance01; ~57 State Hub repos still point at Gitea remotes. Do not retire coulombcore `state-hub` until phase 5 closeout and operator signoff (`CUST-WP-0054-T05`).